Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view small amounts of sensitive information from the system's internal memory. This occurs when the system logs network traffic using the NFLOG mechanism; under certain conditions, it fails to clear a small portion of memory before sending it to a monitoring application. While the leaked data is limited to four bytes at a time, it could potentially expose internal system details to an unauthorized user.
Technical details
An information leak exists in the netfilter nfnetlink_log component of the Linux kernel. When batching multiple NFLOG messages (where inst->qlen > 1), the function __nfulnl_send() appends an NLMSG_DONE terminator. While it allocates space for a struct nfgenmsg payload using nlmsg_put(), it fails to initialize the payload bytes. Because nlmsg_put() only zeroes alignment padding and not the payload itself, four bytes of stale kernel heap data are leaked to userspace. This can be exploited by a local attacker with sufficient privileges to monitor NFLOG traffic to read fragments of kernel memory. The issue has been resolved by switching to nfnl_msg_put(), which correctly initializes the header via nfnl_fill_hdr().
Affected products
- Linux Linux Kernel All versions prior to the 2026-04 patches
Timeline
- 2026-04-01: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-04-22: patched: Fix committed to stable tree
References
- https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c
- https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4
- https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072
- https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b
- https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d
- https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867
- https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c